Malware bad guys tout new trojan guaranteed to evade filters

A new Trojan making the rounds could potentially cause problems for security …

One of the players in the burgeoning malware industry has apparently crafted itself a new "super" Trojan, and is offering it up for sale as a guaranteed detection evader—or your money back. At least, one assumes there's an "or your money back" clause in there somewhere, since black hats willing to pay $1,300 for an illegal software license are probably also willing to pay a desperate Russian peasant $1,300 to beat a malware author to death with a leftover bust of Lenin, before tossing his body in the Volga river.

The new Trojan itself is known as Limbo 2, and has been designed for both customization and variation. Prevx, the company that first detected it, reports that hackers are selling custom-designed variations of the Trojan to customers anxious to avoid detection. If a variant of Limbo 2 is detected, the Trojan can be shifted to a new, undetected approach. The payload itself remains unchanged throughout this process.

The actual infection at the heart of Limbo 2 is also a bit fancier than your average keylogger. Not only will it save and transmit any data you enter as part of a normal logon process, the Trojan will also display spoofed information boxes when users touch on a login page the Trojan finds interesting. The exact data Limbo 2 requests can vary, but includes credit card numbers, e-mail addresses, and additional login details. Any personal information found on the hard drive will also be packed up and shipped back to Botnet Central.

In and of itself, Trojan variation is nothing new. We've seen malware tools designed to quickly create new variations, and security companies have reported a massive surge in the number of malware variations they've had to block in the past 12 months. The speed and customization with which Limbo 2 can adopt a new attack profile, however, is a new twist on what's become standard practice, as is the "guarantee" of invisibility. Whether or not that guarantee holds true, however, is another matter altogether—much of the PR surrounding Limbo 2 would deflate immediately if the Trojan can't live up to its hype for more than a week or two.